A vulnerable issue for Path Traversal,

[willie]

Hi All

I have a vulnerable issue for Path Traversal, how can I fix this issue with on-premise environment (v7.6.13)

[JSDSERVER-6589] URL path traversal allows information disclosure - CVE-2019-15004 - Create and track feature requests for Atlassian products.

PS: Hopefully  you can give me any user-guideline, thanks. 

Thanks,

Willie 

[Kai Becker]

Hi @willie ,

Welcome to the community. Your Jira instance needs to be upgraded asap. This vulnerability is known for more than two years.

all information about it should be documented here: https://confluence.atlassian.com/adminjiraserver/jira-service-desk-security-advisory-2019-11-06-1047539905.html

[willie]

Hi @Kai Becker 

Thanks very much for your help, please do me a favor again, what will be happened  if  I add rules to JIRA system as following codes.

I can't update to latest version, because my Jira is on-premise(v7.6.13), in other words, I have to use this rules for a  vary long time,  Will the JIRA application be affected?

Please give me more messages about this issue, thanks again

<rule>
    <from>/servicedesk/.*\.jsp.*</from>
    <to type="temporary-redirect">/</to>
</rule>

[willie]

Hi @Kai Becker 

Sorry bother you again, if I want to add the rules into the urlrewriter.xml , how can I do with multiple "Rules"

For example: this is my JIRA urlrewriter.xml content, how to add a another rule

<urlrewrite>
<!-- Caching of static resources -->
<class-rule class="com.atlassian.jira.plugin.webresource.CachingResourceDownloadRewriteRule"/>
<!-- @since 5.0 [KickAss]-->
<rule>
  <from>^/issues(\?.*)?$</from>
  <to type="permanent-redirect">issues/$1</to>
</rule>

### Could I add this codes under the this position

<rule>
    <from>/servicedesk/.*\.jsp.*</from>
    <to type="temporary-redirect">/</to>
</rule>

</urlrewrite>

Thanks again ,

Willie

[Kai Becker]

Hi @willie ,

sorry for the late response. I'm not an sysadmin, so I can't  give you any tips/hints on url rewrite stuff. Sorry about that.

But I would highly recommend, that your Jira should not be accessible outside your company network. Jira 7.6.x reached End of Life on 16 November, 2019, so there might be a lot more vulnerabilities in your current setup.

[willie]

Hi @Kai Becker 

Sorry to bother you again, I've tried many times with production and staging server but unfortunately, it isn't working for me, please do me a favor, thanks again.

PS: Please check my test recording 

[willie]

Hi @Kai Becker 

I've tried to disable the jira-dnd-attachment-plugin but it still show "Path Traversal" issue, please help me. thanks. 

```

bash /opt/jira/bin/start-jira.sh --disable-addons=com.atlassian.jira.plugins.jira-dnd-attachment-plugin

```